The written safety program: what every US employer needs (2026 guide)

Ask an OSHA compliance officer, a general contractor prequalifying a sub, or an insurance underwriter what they want to see first, and the answer is almost always the same: your written safety and health program. It is the single document that says, in effect — here is how this company keeps its people safe. Yet it is also one of the most misunderstood documents in American business, treated either as a one-time binder you buy and shelve, or as something so daunting that small employers never start. It is neither. This guide explains what a written safety program actually is, the law that sits behind it, exactly what it should contain, and how to keep it alive so it is worth something when it matters.

What a written safety program actually is

A written safety program is your documented system for finding hazards in your workplace and controlling them before they hurt someone. It sets out your safety policy, who is responsible for what, the hazards specific to your operations, the controls and safe work practices you use, how you train people, how you investigate incidents, and how you review and improve the whole thing over time. The key word is your. A generic manual downloaded from the internet with your logo dropped on the cover is not a safety program; it is a document pretending to be one, and an experienced inspector or safety prequalifier will see through it quickly. You can absolutely start from a template — but the substance has to describe the work you actually do.

The law behind it

The foundation is the Occupational Safety and Health Act of 1970. Section 5(a)(1) — the General Duty Clause — requires every covered employer to furnish a workplace "free from recognized hazards that are causing or are likely to cause death or serious physical harm." Beyond that general duty, many specific OSHA standards require a written program by name: Hazard Communication (29 CFR 1910.1200), Respiratory Protection (1910.134), the Control of Hazardous Energy or Lockout/Tagout (1910.147), Bloodborne Pathogens (1910.1030), Permit-Required Confined Spaces (1910.146), Process Safety Management, Emergency Action Plans and more. Which of these apply depends on your work. On top of federal OSHA, 22 states and territories run their own OSHA-approved State Plans, some of which go further than federal rules. California, for instance, requires nearly every employer to have a written Injury and Illness Prevention Program (IIPP) under Title 8; several other states have their own program mandates.

Even where no single standard forces a comprehensive written program, OSHA strongly recommends one. Its Recommended Practices for Safety and Health Programs lay out the framework the rest of this guide follows — and increasingly, it is not the government but your customers who make it mandatory in practice, because no serious GC will let an uninsured, unprogrammed sub onto the site.

The core elements OSHA expects

OSHA's Recommended Practices are built around a recognizable set of core elements, and a good written program addresses each.

Management leadership. A signed policy from the top that makes safety a stated value, commits resources to it, and sets expectations for everyone. Naming real people by role matters here — "the site superintendent is responsible for daily inspections" means something; "management will ensure safety" does not.

Worker participation. How employees are involved in finding and fixing hazards — toolbox talks, safety committees, a no-reprisal way to report hazards and near misses. OSHA is clear that programs work best when the people doing the work help build them.

Hazard identification and assessment. The engine of the program. A systematic look at your operations — routine and non-routine — to identify existing and potential hazards, informed by inspections, incident history, your OSHA 300 log, safety data sheets and employee input.

Hazard prevention and control. The specific measures you use, chosen using the hierarchy of controls: eliminate the hazard, substitute something safer, engineer a control, use administrative controls and safe work practices, and rely on personal protective equipment last. This is where your JHAs, LOTO procedures, PPE assessments and maintenance schedules live.

Education and training. How you make sure workers and supervisors understand the hazards and the controls — new-hire orientation, task-specific training, OSHA 10/30 Outreach, competent-person training, and refreshers.

Program evaluation and improvement. How you check that the program is working — audits, tracking of corrective actions, review of incidents and metrics — and update it when work, equipment or people change.

How to actually write one

The prospect stalls people, so break it into steps. Walk your workplace and list hazards honestly, starting from what you can see and what your crew tells you, not from a template's generic list. For each hazard, assess who is exposed and how badly they could be harmed, and what you already do about it. Decide what more is needed using the hierarchy of controls. Write it in plain language, name the people responsible, and set out your training, incident-reporting, emergency and recordkeeping arrangements. Then — and this is the step most templates skip — bring it to your employees, train them on it, and get their input. A program written in secret and filed away fails the most basic test of all: nobody follows it.

Why "written once" is the trap

The most common failure is not the absence of a program but its staleness. A binder assembled two years ago, describing equipment you no longer run and people who have left, is arguably worse than nothing — it shows an inspector that safety is a paperwork exercise here. A living program is reviewed at least annually and whenever something changes: a new process, a new piece of equipment, a serious incident, a new crew. The document should point to current records — training that is in date, certifications that have not lapsed, JHAs for the jobs you actually run, an OSHA 300 log that is up to date. That is exactly the gap software is built to close, and it is why a program that lives in a system beats one that lives in a drawer.

Where Complys fits

Complys builds your written safety program and your JHAs around the work you actually do, then keeps them current alongside your worker certifications, training matrix and OSHA 300 log — with reminders before anything lapses and a live compliance profile you can share with the GCs and clients hiring you. It turns the program from a document you dread into a score you can watch.